WordPress powers more than 40% of all websites on the internet, which makes it by far the most popular website platform there is. Originally a blogging tool, it's now a full content management system (CMS) running everything from small business sites to large e-commerce stores.
One of WordPress's strengths is that when a security issue is discovered, it's usually patched very quickly.
But the bad guys are always rattling the doors, and if you're not careful, your site can be compromised. I've been managing WordPress sites since 2006, and in that time I've learned a few things about keeping them safe. Here are the essential ways to secure your WordPress site.
1. Secure Your WordPress Administrator Account
Older WordPress installs automatically created an administrator account named "admin." That's no longer the default (you choose the username during installation now), but millions of long-running sites still have an "admin" account, which leaves only a password between them and disaster.
Attackers know this. Automated brute-force attacks constantly try to log into WordPress sites using "admin" or "administrator" and thousands of common passwords. Once a site is compromised, it can be used to spread malware or launch more attacks.
So when you install WordPress, don't use "admin", and don't use your author name either (it's too easy to find). Use something unguessable. If you're already stuck with an "admin" account, you have two options:
Create a new admin account and delete the default
Log in as "admin," go to Users in the dashboard, and create a new account with administrator privileges. (WordPress won't allow the same email on two accounts, so change the email on the old "admin" account first, or use a different one for the new account.) Then log in as the new user and delete the "admin" account. WordPress will let you reassign its posts so nothing is lost.
Change the username in the database
You can change the username directly in the database via phpMyAdmin, but this is advanced, and I don't recommend it unless you really know what you're doing. If you do, back up your database first. There's no undo.
Either way, pair that username with a strong password, a mix of upper- and lower-case letters, numbers, and symbols.
Whatever you do, don't use your birthday, your kids' names, or your pet's name, unless your pet is named something like thu#YhaAe45&!
"Here, thu#YhaAe45&!, here boy!" Yeah, right.
I know, you'll never remember a password like that. The answer is a password manager, like Bitwarden or 1Password, which generates and stores strong, unique passwords for every account so you only have to remember one. (My wife prefers to build hers from the first letter of each word in a line from a favorite song, mixing in capitals, a number, and a symbol, also a solid approach.)
2. Turn On Two-Factor Authentication (2FA)
This is the single most effective upgrade you can make, and it's the one too many sites skip. Even a strong password can be stolen, guessed, or leaked in a data breach. Two-factor authentication adds a second lock: after entering your password, you also confirm a one-time code from an authenticator app (like Google Authenticator or Authy) or approve a passkey. Without that second factor, a stolen password is useless.
Turn it on for every administrator account. Wordfence (below) includes 2FA, and free plugins like Two-Factor or miniOrange add it as well. It takes a few minutes to set up and dramatically reduces your risk.
3. Protect Your Login Page
Because brute-force attacks hammer your login page, lock it down. Two easy measures:
- Limit login attempts. Most security plugins (including Wordfence and Solid Security) can lock out an IP address after a set number of failed attempts, which stops password-guessing bots cold and can email you when someone's trying.
- Hide your login URL. A plugin like WPS Hide Login changes your login address from the default
/wp-adminto a custom, secret URL, so the bots can't even find the door. It takes about two minutes to set up.
4. Turn Off the File Editor
WordPress lets administrators edit theme and plugin files right from the dashboard, which is exactly what an attacker will do if they crack your password and get in. Disable it by adding this line to your wp-config.php file:
define('DISALLOW_FILE_EDIT', true);
After that, the theme and plugin editors return a "you do not have sufficient permissions" message. (You can reach wp-config.php through your hosting control panel, usually cPanel, or via FTP.)
5. Run a Security Plugin
A good security plugin is your site's alarm system, firewall, and antivirus rolled into one. Wordfence is the one I put on every site I'm responsible for: it includes a firewall, malware scanning, login protection, and 2FA, runs automated security scans, and emails me the moment anything looks off (it's how I catch those "admin" login attempts). The free version is excellent; the premium version adds things like country blocking and real-time threat updates.
Wordfence isn't the only good option: Solid Security (formerly iThemes Security) and All-In-One Security are solid alternatives, and for hands-off, cloud-based protection, services like Sucuri are worth a look. Pick one, but don't run two full security plugins at once, as they can conflict.
6. Keep Everything Updated and Backed Up
This is the unglamorous one that prevents the most break-ins. The vast majority of hacked WordPress sites were running outdated software. So keep WordPress core, your theme, and every plugin up to date, turn on auto-updates where you can, and delete any plugins or themes you're not using (every one is a potential way in).
And back up regularly. If the worst happens, a recent backup turns a catastrophe into an inconvenience. Many hosts include automated backups; if yours doesn't, a backup plugin or service will handle it for you.
Have Fun, but Play Safe
Just like your mom used to say when you left the house: have a great time with your WordPress site, but make sure all your hard work stays safe from the many dangers online.
There's plenty more you could do, and you may have your own favorite tools and methods. Leave a comment and let me know what they are. And if you'd rather have someone manage all of this for you, get in touch with our team.
0 Comments